Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: pass (nike.apache.org: domain of jorton@redhat.com designates
 209.132.183.28 as permitted sender)
Date: Tue, 15 Jul 2014 13:38:20 +0100
From: Joe Orton <jorton@redhat.com>
To: dev@httpd.apache.org
Subject: Re: svn commit: r1610674 - in /httpd/httpd/trunk: include/ap_mmn.h
 include/httpd.h modules/proxy/mod_proxy_http.c modules/proxy/proxy_util.c
 server/util.c
Message-ID: <20140715123820.GA26706@redhat.com>
Mail-Followup-To: dev@httpd.apache.org
References: <20140715122701.0365D23888D7@eris.apache.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
In-Reply-To: <20140715122701.0365D23888D7@eris.apache.org>
User-Agent: Mutt/1.5.23 (2014-03-12)
Organization: Registered in England and Wales under Company Registration No.
 03798903
  Directors: Michael Cunningham (US), Michael O'Neill (Ireland),
 Matt Parson (US), Charles Peters (US)

On Tue, Jul 15, 2014 at 12:27:00PM -0000, jorton@apache.org wrote:
> Author: jorton
> Date: Tue Jul 15 12:27:00 2014
> New Revision: 1610674
> 
> URL: http://svn.apache.org/r1610674
> Log:
> SECURITY (CVE-2014-0117): Fix a crash in mod_proxy.  In a reverse
> proxy configuration, a remote attacker could send a carefully crafted
> request which could crash a server process, resulting in denial of
> service.

Backporting this to 2.4.x is non-trivial since trunk has diverged from 
2.4.x via at least this change to how r->headers_in is handled:

http://svn.apache.org/viewvc?view=revision&revision=1588527

I am not sure how/whether that impacts the backport.

We have a simpler version of the crasher fix which doesn't add strict 
interpretation of the Connection header - I am going to propose that for 
2.4.x.  If somebody wants to propose a backport of r1610674 for 2.4.x 
please jump to it ASAP!

Regards, Joe